CRA ‘Free Patches’ Doesn’t Mean ‘No Subscription Needed’
I keep hearing the same interpretation of the Cyber Resilience Act (CRA): when the CRA says that security updates must be provided “free of charge,” it means the enterprise open-source subscription model is effectively over in Europe.
The reasoning sounds simple. Open-source software is available to anyone. Therefore, enterprise Linux and other commercial open-source providers will be required to make their security patches available to anyone, without a subscription, for at least five years.
If you are in a hurry, here is the answer:
No. CRA “free patches” does not mean “no subscription needed.”
This is my personal view. It is not legal advice. It is not my employer’s position.
It means that a manufacturer generally cannot impose an additional charge for the security update itself when fulfilling its CRA obligations.
Two other misconceptions hidden in that interpretation are also worth correcting: the support period is not always five years,...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
